What Is Skyhigh Security? Hybrid Mesh SSE, Browser Controls, and Where It Fits in 2026

Answer first: Skyhigh Security is the former McAfee Enterprise cloud security business, spun out in 2022 and now sold as a data-centric Security Service Edge (SSE) platform: SWG, CASB, DLP, private access, DSPM and, since October 28, 2026, a "Hybrid Mesh SSE" that moves some inspection back onto local enforcement points so office traffic skips the cloud round trip. That launch is a vendor admitting what we have said for years: the cloud detour costs latency and money. The difference is where you remove it. Skyhigh puts the proxy back near the office. dope.security puts it on the laptop, so every user, in every location, inspects locally with nothing new to run.

If you are shortlisting Skyhigh, or you inherited it from a McAfee-era contract, this is the plain-English guide: what Skyhigh is, what it does well, what the Hybrid Mesh launch changes, and where an on-device SWG is the simpler answer. We are a direct competitor, so read it as a sharp but sourced take. If you already know you are leaving, start with our guide to Skyhigh Security alternatives instead.

Every claim about Skyhigh below leads with Skyhigh's own announcements and analyst citations. Where we cite reviewer sentiment, we say so. Where something is unverified, we leave it out.

What is Skyhigh Security?

Skyhigh Security is a San Jose company that sells a cloud security platform built around data protection. Its lineage runs through McAfee Web Gateway (an on-prem proxy appliance), the Skyhigh Networks CASB that McAfee bought in 2018, and the 2022 carve-out of McAfee Enterprise's SSE products into a standalone company under Symphony Technology Group. The legal entity is Musarubra US LLC, doing business as Skyhigh Security. If you have ever wondered why your contract, your portal and your support emails carry different names, that history is why.

The current portfolio covers secure web gateway, CASB and SaaS security, data loss prevention, private application access (ZTNA), remote browser isolation, cloud-native application protection, and the newer additions of 2026: Data Security Posture Management (DSPM) and patent-pending Secure Browser Controls, which Skyhigh positions for AI prompts and clipboard pastes inside the browser session. All of it is sold under one SSE umbrella, with data protection as the connective tissue.

Skyhigh's strongest external validation in 2026 is analyst-driven. In the Gartner Critical Capabilities for Security Service Edge dated August 3, 2026, Skyhigh ranked first of eight vendors evaluated in the Advanced SSE use case. We will not state a 2026 Magic Quadrant position for Skyhigh here, because we have not read the reprint, and neither should you trust anyone who quotes one without it.

How Skyhigh's SSE works, and why that mattered until October

Until this quarter, Skyhigh's SSE ran like every other first-generation cloud SSE: a client on the device, or a PAC file or tunnel from the office, steers traffic to a Skyhigh point of presence, where TLS is decrypted, policy is applied and the request is forwarded on. Skyhigh expanded that footprint by adding Oracle Cloud regions to its own, and it sells sovereign and hybrid deployments where the inspection stack can run inside a customer-controlled environment. That hybrid story is the part Gartner rewarded and the part Skyhigh is now leaning on.

The architecture carries the familiar trade-offs. Every request a remote user makes detours to the nearest PoP and back before reaching its destination. The farther the user is from a PoP, the longer the detour. Skyhigh's own October 28 press release says it plainly: "sending in-office traffic out to the cloud and back adds cost, latency, and complexity without adding protection." We agree. We would only add that the same sentence is true for the home office, the hotel and the client site, which is where most of your people actually are.

What Hybrid Mesh SSE changes

On October 28, 2026, Skyhigh launched Skyhigh Hybrid Mesh SSE and declared it globally available. The pitch has three parts. First, one policy framework that enforces "locally when they are local and through the cloud when they are not." Second, a sovereignty and resilience story: customers control where traffic is decrypted, inspected and logged, and keep operating when the external cloud path fails. Third, economics: Skyhigh claims up to 50 percent lower SSE operating costs than cloud-only alternatives, through the adaptive architecture plus flexible pricing.

Read the press release carefully and the shape of the product emerges. Hybrid Mesh SSE is a return of local enforcement points for on-site users, stitched to the Skyhigh cloud for everyone else, under a shared policy plane. That is a sensible evolution for a vendor with a Web Gateway appliance heritage and a large installed base of office-centric enterprises, and the Nationwide Building Society quote in the release tells you the target buyer: regulated, multi-site, with on-prem systems that are not going anywhere.

Here is what the launch does not change. A remote worker still rides the cloud path. A traveler in Singapore whose nearest Skyhigh PoP is far away still pays the detour. A local enforcement point is one more thing to size, patch, fail over and pay for, and "up to 50 percent lower operating costs" is a vendor projection, not a benchmark you can run. The release calls it a first-to-market architecture. We would call it a thoughtful patch on a model that has the proxy in the wrong place for a workforce that is 74 percent hybrid or on-site by Skyhigh's own Gallup citation, which means 26 percent fully remote plus everyone who leaves the building on any given day.

Where the latency actually comes from

Latency in a cloud SSE is not one thing. It is the round trip to the PoP, the TLS termination and re-origination, the policy and DLP inspection queue, and the second hop to the destination. Skyhigh's hybrid mesh shortens the first hop for office users by moving the PoP next door. It does not remove the hop, and for every user not in that office it does not shorten anything.

The on-device model removes the hop rather than relocating it. The dope.security agent terminates TLS on the laptop, applies URL filtering, Cloud Application Control and Dopamine DLP locally, and sends the request straight to its destination. There is no PoP to be near, no tunnel to keep up, and no local appliance to run. That is why we publish a 4x performance figure against legacy proxy SWGs and keep the agent under 100 MB of RAM.

Measure your own detour. The Fly-Direct Speed Test on this page measures your live round-trip latency and shows what a cloud proxy adds per application, so you can compare a local mesh, a cloud PoP and on-device inspection with the dope.security SWG on your own connection. Prefer a guided look? Start a free trial and run it on your own laptops.

Takeaway: a shorter detour is still a detour. Inspection on the device is the only architecture with no round trip to shorten.

Skyhigh's AI controls: browser-first, sanctioned-first

Skyhigh's 2026 AI work is real and worth describing accurately. The patent-pending Secure Browser Controls, announced earlier this year, move DLP enforcement into the browser session so prompts, pastes and uploads into AI tools can be inspected at the point of origin, including for apps that talk over WebSockets, which a proxy struggles to inspect. Skyhigh's mid-2026 updates also added prompt-level protections aimed at prompt injection and jailbreak content. The October release adds AI agents and MCP servers to the threat narrative and promises "Zero Trust for people and AI, everywhere."

The gaps are structural rather than missing features. Browser controls govern what happens in the browser. ChatGPT Desktop, Claude Desktop, Cursor and any CLI that calls a model never pass through a browser session. Skyhigh's deepest AI controls still center on sanctioned, API-connected tools, while a personal account on the same AI domain falls back to coarser web and upload control. We have not found public documentation of licensing or of tenant-level corporate-versus-personal enforcement across desktop and IDE clients, so we will not claim Skyhigh lacks it. We will say we could not find it, and you should ask.

By contrast, the dope.security approach is the endpoint, not the browser tab. Shadow AI discovery shows every AI app in use and who uses it, with a personal versus enterprise-licensed account breakdown. SWG policy allows, warns or blocks by app. Cloud Application Control restricts ChatGPT and Claude to your enterprise tenant and blocks personal logins on the same domain. Dopamine DLP reads the prompt or the file on the device and classifies it by meaning. One agent, every process, no add-on SKU. Our take on whether you need a secure enterprise browser at all covers the browser-versus-endpoint question in depth.

Skyhigh vs dope.security: the head-to-head

Both products inspect encrypted traffic, filter the web, control cloud apps and run DLP. The differences are about where that work happens and what you have to operate to make it happen.

• Where inspection runs: Skyhigh decrypts and inspects at a cloud PoP or, with Hybrid Mesh SSE, at a local enforcement point near the office; dope.security decrypts and inspects on the device itself, for every user, with no PoP and no local appliance.
• Latency: Skyhigh shortens the round trip for on-site users and leaves it in place for remote users; dope.security has no round trip to shorten, which is the basis of our 4x performance claim against legacy proxy SWGs.
• What you operate: Skyhigh's hybrid model adds local enforcement infrastructure to size and maintain alongside the cloud tenant; dope.security is one agent and one console, with policy landing on every endpoint in under a minute.
• AI governance: Skyhigh's controls are browser-centered and strongest on sanctioned, API-connected AI; dope.security governs browser, desktop and IDE AI from the endpoint with tenant-level Cloud Application Control and Dopamine DLP, natively included.
• Data residency: Skyhigh sells sovereignty as a deployment option where you choose the inspection location; dope.security's inspection never leaves the device, so there is no third-party inspection location to govern. Our piece on data sovereignty and SSL inspection explains why that matters to auditors.
• Analyst standing: Skyhigh ranked first in the Advanced SSE use case of the 2026 Gartner Critical Capabilities; dope.security is a Gen 3, on-device architecture that Gartner's SSE frameworks were not written around, which is exactly the point.
• Heritage: Skyhigh's stack combines McAfee Web Gateway, the Skyhigh Networks CASB and later acquisitions under a brand that has changed several times; dope.security was built from scratch as one console. Read our Skyhigh versus Netskope versus dope.security comparison for the three-way view.

Who should pick Skyhigh, and who should not

Skyhigh is a credible choice for a large, regulated, multi-site enterprise that runs significant on-prem infrastructure, wants a vendor with sovereign and hybrid deployment options, and has the team to operate a mesh of local enforcement points plus a cloud tenant. If your evaluation is scored on Gartner's Advanced SSE criteria, Skyhigh will score well, and its DLP engine has deep McAfee roots.

If you are a 250 to 5,000 person company with a hybrid or remote workforce, a lean IT team, and an AI governance problem that lives on laptops rather than in a data center, the mesh solves a problem you do not have and adds infrastructure you do not want. That is the profile where an on-device SWG wins on speed, deployment time and total cost. A Fortune 100 customer took dope.security from 900 to more than 18,000 devices in a matter of weeks with a silent Intune push and no local infrastructure at all. For a wider view of the architecture choice, see the two ways to run SSE in 2026.

Try the version with no mesh to manage

Skyhigh's Hybrid Mesh SSE is a serious vendor conceding that the cloud round trip is a tax. Our answer is to stop paying it everywhere, not just in the office. Inspection on the device, one console, AI governance built in, and nothing new to rack. Start a free trial or see how dope.security governs AI on every endpoint.

Frequently Asked Questions

Is Skyhigh Security the same as McAfee?

Skyhigh Security is the cloud security business that was carved out of McAfee Enterprise in 2022 and now operates as a standalone company under Symphony Technology Group. Its products descend from McAfee Web Gateway and the Skyhigh Networks CASB that McAfee acquired in 2018. The McAfee consumer brand is a separate company and does not sell Skyhigh's SSE products.

What is Skyhigh Hybrid Mesh SSE?

Hybrid Mesh SSE is the architecture Skyhigh launched on October 28, 2026 that applies one policy locally when users and apps are on-site and through the Skyhigh cloud when they are not. Skyhigh positions it around sovereignty, resilience and up to 50 percent lower SSE operating costs compared with cloud-only alternatives. It shortens the cloud round trip for office users; remote users still route through a cloud PoP. dope.security removes the round trip for every user by inspecting on the device.

Does Skyhigh Security work for remote and traveling employees?

Yes, through its cloud PoPs, which Skyhigh expanded using Oracle Cloud regions. Remote users steer traffic to the nearest PoP for inspection, so performance depends on how close that PoP is. The Hybrid Mesh launch does not change the remote path. An on-device SWG like dope.security inspects locally on any network, which is why it performs the same in a home office, a hotel or mainland China.

How much does Skyhigh Security cost?

Skyhigh does not publish list pricing; it sells per-user subscriptions by module and tier through its sales team and partners, and reviewers report that API integrations and advanced modules add to the quote. The October 2026 launch references "flexible pricing" for Hybrid Mesh SSE without disclosing terms. dope.security publishes its pricing and includes SWG, Cloud Application Control, shadow AI discovery and Dopamine DLP in one per-user subscription.

Can Skyhigh block personal ChatGPT while allowing the enterprise ChatGPT tenant?

Skyhigh's documented AI controls focus on browser-session enforcement and on sanctioned, API-connected AI tools, with personal AI use falling back to web and upload controls. We could not find public documentation of tenant-level corporate-versus-personal enforcement across browser, desktop and IDE clients, so ask Skyhigh directly. dope.security does this natively with Cloud Application Control, which allows your ChatGPT Enterprise or Claude Enterprise tenant and blocks personal accounts on the same domain, enforced on the device.

Is Skyhigh Security a Gartner Leader in 2026?

Skyhigh ranked first of eight vendors in the Advanced SSE use case of the Gartner Critical Capabilities for Security Service Edge published August 3, 2026, according to Skyhigh's announcement. The Critical Capabilities report is a separate document from the Magic Quadrant, and we have not read a 2026 Magic Quadrant reprint that states Skyhigh's quadrant, so we do not state one here.